> ## Documentation Index
> Fetch the complete documentation index at: https://docs.periphery.exposed/llms.txt
> Use this file to discover all available pages before exploring further.

# Finding clones

> Use the favicon hash to find every app serving the same favicon: forks, redeployments, and phishing kits.

Apps built from the same template, forked from the same repository, or cloned by a phishing kit usually ship the same favicon. Periphery hashes every favicon it fetches, and the hash is searchable.

## From the console

The favicon sits next to the hostname; hover it to see the hash. On a result row, clicking it adds `faviconHash:<hash>` to the query you are on, so the other terms still apply; remove them to widen the search. On an app page, clicking it runs the bare `faviconHash:<hash>` search and shows every app that serves the same icon.

## From a hash you already have

The hash is the favicon hash used by Shodan (`http.favicon.hash`), Censys, and FOFA: MurmurHash3 with seed 0 over the base64-encoded favicon bytes, read as a signed 32-bit integer. A hash from any of those tools can be pasted into Periphery, and a hash from Periphery can be pivoted back into them.

```text theme={null}
faviconHash:-247388890
```

Comma-separate several hashes to search them together:

```text theme={null}
faviconHash:-247388890,81586312
```

## Reading the results

* **A well-known product icon** (a framework default, a SaaS logo) returns many unrelated apps. Combine with `domain:` or free text to narrow.
* **A company logo** on hostnames outside the company's own domain is worth a look: a forgotten staging deploy, a partner integration, or an impersonation.
* Apps without a fetched favicon have no hash and never match.